Comparison

Manual Intune exports or scheduled backups

Intune has no built-in backup, so many admins protect it by hand: export a policy before a risky change, keep notes and screenshots, and rebuild from the audit log if something goes wrong. For a small tenant with rare, planned changes, that can be enough. It stops working for changes nobody planned. This page compares the manual way with scheduled backups, and lists what to do if you stay manual.

At a glance

A manual export protects only the policies someone remembered to export, as they were at that moment.
Microsoft documents a JSON export in the Intune admin center for Windows settings catalog policies, one policy at a time. Other policy types are not covered by it.
Importing an exported policy creates a new policy with a new ID. Microsoft does not document that assignments come with it, so plan to set them again.
Intune audit logs show who changed which object and which properties changed, but they do not hold the full policy, so they cannot rebuild it on their own.
Scheduled backups run in the desktop app while it runs on a signed-in computer: weekly on Community, daily on Pro and MSP.
Community is free for one tenant and needs no license key. Pro covers 2 tenants, and Pro and MSP include a 30-day free trial.

What backing up by hand looks like

There is no single manual method, but most combine some of these:

Before editing a Windows settings catalog policy, export it to a JSON file from the Intune admin center, or duplicate it.
For other policy types, keep screenshots, a configuration document or notes in the change ticket.
Store the files in a share or document library, named by date.
When a policy is deleted or broken, import the JSON file as a new policy, or rebuild the policy in the admin center from the notes and the audit log entries, then assign it again.

Side by side

Backing up Intune by hand compared with TenuVault
Question	By hand	TenuVault
Cost	Free, plus the time for every export and rebuild	Community is free for one tenant; Pro and MSP are paid
What can be saved	Windows settings catalog policies as JSON; other types as screenshots or notes	40 Intune object types in nine areas, with their assignments where Intune has them
When a copy exists	When someone remembers, usually before a planned change	On a schedule, weekly on Community and daily on Pro and MSP, plus backups you start yourself
A change nobody planned	Covered only if a recent export happens to exist	Covered by the last scheduled backup before it
Assignments	Recreated by hand from notes	Saved with each object; restored on Pro and MSP
Restore	Import as a new policy, or rebuild by hand	An unassigned copy on every plan; in place under the original name on Pro and MSP
Where copies are kept	Wherever you save the files, usually unencrypted	Encrypted on the computer or in your own Azure storage
History	The files you kept	Up to 30 days on Community; 7 to 365 days or forever on Pro and MSP
What changed	The audit log: who changed which object and properties	Every changed setting between two backups, before and after

Where the manual way breaks

Manual backups fail in predictable places, and most of them only show up during a recovery:

The change that hurts is the one nobody planned: a policy deleted by mistake, an edit by another admin, or a script that changed many policies at once. No export was made before it.
Policy types the settings catalog export does not cover, such as compliance policies, app protection policies, enrollment configurations and scripts, depend on notes and screenshots that are rarely complete.
Assignments, exclusions and assignment filters are easy to forget in notes, and they decide which devices a restored policy reaches.
Rebuilding takes time per policy, and a mistyped value in a rebuilt security setting is hard to spot.
Exports stored in a share are not encrypted, and some settings, such as the values of encrypted OMA-URI settings, are secrets.

What TenuVault does, and its limits

TenuVault backs up 40 Intune object types in nine areas, with their assignments where Intune has them. Scheduled backups run in the desktop app while it runs on a signed-in computer: weekly on Community, daily on Pro and MSP. On Pro and MSP, cloud backups run the schedule in an Azure Automation account in your own subscription, so no computer has to be on. Backups are encrypted with AES-256-GCM on the admin's computer and kept in a local folder or network share, or on Pro and MSP in your own Azure storage account.

Community restores one item at a time as a new, unassigned copy. Pro and MSP add restoring many items at once, replacing items in place, recreating deleted items under their original names and restoring assignments. Drift detection compares two complete backups and lists every added, changed and deleted item down to the setting, on every plan.

Limits that apply to every backup: App installer files, Apple tokens and private keys, because Microsoft Graph does not return them. Assignments are saved as references to Entra groups; the groups themselves are not backed up. A scheduled backup on a computer only runs while TenuVault runs there; a missed backup runs once when TenuVault starts again.

When you do not need TenuVault

Manual exports can be enough when all of these are true:

You run one small tenant, and one or two admins make every change.
Changes are rare and planned, and you export before each one.
Accidental deletes are blocked by Multi Admin Approval, so a second admin has to approve them.
You could rebuild every policy you have from your documentation within the time your organization accepts.

If you stay manual

Make the manual way as reliable as it can be:

Export every settings catalog policy before you change it, and keep the file with the change record and the date.
Record each policy's assignments, exclusions and filters next to its export, because an import does not bring them back.
For policy types without an export, keep a configuration document that lists every setting, not only the changed ones.
Turn on Multi Admin Approval for deleting policies, so one mistake cannot delete them alone.
Practice once: import an export as a new, unassigned policy and compare it with the original.

When TenuVault saves you time

Scheduled backups are worth it when:

Several admins, scripts or partners change the tenant, and not every change is planned.
You use many policy types beyond the settings catalog: compliance, app protection, enrollment, scripts and apps.
A deleted policy has to come back with its assignments, quickly, by whoever is on call.
You need dated copies of the configuration for an audit or a change review.

Read the technical guides

Product scope reviewed 3 November 2026. Check your installed release and the current plan table before using a workflow.

Frequently asked questions

Can I back up Intune manually?

Partly. The Intune admin center exports Windows settings catalog policies to JSON one at a time. Other policy types are not covered by that export, so a manual backup of them is screenshots, notes or a Graph script. An import always creates a new policy.

Is a manual Intune export enough for a small tenant?

It can be, if changes are rare and planned, you export before each one, Multi Admin Approval guards deletes and you could rebuild every policy from your documentation. It does not cover changes nobody planned.

How often should Intune be backed up?

Often enough that the newest copy is older than the changes you can afford to redo by hand. Many tenants back up daily and before every large change. TenuVault Community schedules weekly backups; Pro and MSP schedule daily backups.

Can the Intune audit log replace a backup?

No. The audit log records who changed which object and which properties changed, but not the full policy. It helps you rebuild a policy; it cannot recreate it on its own.